Is it okay to open a public issue about a wrong "good" example?

[stsewd]

Hi, I found one example from the repository that is suggested as safe/good is still vulnerable to the problem it says to prevent. Should I just open a public issue about it? Or do you prefer to handle it privately? I was about to just open an issue, but I'm asking just in case.

[ginsbach]

Please open an issue for the problem that you identified so that the team can have a look.

[stsewd]

#16041